REQUEST-944-APPLICATION-ATTACK-JAVA.conf #990

spartantri · 2017-12-28T22:09:36Z

Java attacks updated config

The rule will ignore non all upper case header names, which I don't think was the idea behind this rule. 3.2. Header Fields Each header field consists of a case-insensitive field name followed by a colon (":"), optional leading whitespace, the field value, and optional trailing whitespace.

emphazer · 2017-12-29T00:21:32Z

@spartantri looks really hot! :-)
One question, does the REQUEST_BODY processor include the REQUEST_HEADERS?
Like Accept-Encoding for example.

fzipi · 2017-12-29T15:57:20Z

@spartantri Sorry to tell you this, but it doesn't follow the contributing guidelines...

spartantri · 2017-12-31T07:47:34Z

@fzipi changed the rules to match the actions order, @emphazer added the REQUEST_HEADERS as it is not part of REQUEST_BODY, and also added an additional PL4 rule including the different b64 encoded strings of interesting keywords

emphazer · 2017-12-31T20:09:43Z

@spartantri great! Thats what we need with REQUEST_HEADERS! Thanks

fzipi · 2018-01-01T16:58:54Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

@@ -0,0 +1,290 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.3.1.0
+# Copyright (c) 2006-2016 Trustwave and contributors. All rights reserved.


Shouldn't this be 2018 now?

I don't know but changed anyway

fzipi · 2018-01-01T17:00:18Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},\
+    setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{matched_var_name}=%{tx.0}'"
+
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML|XML:/* \


Is this normal indentation?

fzipi · 2018-01-01T17:01:03Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    ver:'OWASP_CRS/3.1.0',\
+    severity:'CRITICAL',\
+    chain"
+        SecRule MATCHED_VARS "@rx (?:unmarshaller|base64data|java\.)" \


This 'SecRule' should be aligned with the previous 'chain'

fzipi · 2018-01-01T17:01:58Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    ver:'OWASP_CRS/3.1.0',\
+    severity:'NOTICE',\
+    chain"
+        SecRule MATCHED_VARS "@rx (?:runtime|processbuilder|clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure)" \


This 'SecRule' should be aligned with the previous 'chain'

fixed, missed that one

fzipi · 2018-01-01T17:02:10Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    ver:'OWASP_CRS/3.1.0',\
+    severity:'CRITICAL',\
+    chain"
+        SecRule MATCHED_VARS "@rx (?:runtime|processbuilder)" \


Fixed all those, sorry about that, it is my personal identation style to distinguish short chains, anyway, removed all those extra 4 spaces to allign to contributing.md

spartantri · 2018-01-02T15:55:56Z

mmm I don't know why File upload rules get mixed with this so I will move that file off to finish this PR and once done move it back to create a new PR

spartantri

Updated sugested fixes

spartantri · 2018-02-05T18:26:29Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    setvar:'tx.msg=%{rule.msg}',\
+    setvar:tx.rce_score=+%{tx.notice_anomaly_score},\
+    setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},\
+    setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{matched_var_name}=%{matched_var}'"


I'm not sure how common this may be for legitimate purposes so let's start with 3 and lower it once we have some feedback.

spartantri · 2018-02-05T18:27:57Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    ver:'OWASP_CRS/3.1.0',\
+    severity:'NOTICE',\
+    chain"
+        SecRule MATCHED_VARS "@rx (?:runtime|processbuilder|clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure)" \


fixed, missed that one

spartantri · 2018-02-05T18:37:14Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    setvar:'tx.msg=%{rule.msg}',\
+    setvar:tx.rce_score=+%{tx.notice_anomaly_score},\
+    setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},\
+    setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{matched_var_name}=%{matched_var}'"


no there is no chain in this one is intended to complain on most common keywords to spawn a process

spartantri · 2018-02-05T18:38:08Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    setvar:'tx.msg=%{rule.msg}',\
+    setvar:tx.rce_score=+%{tx.notice_anomaly_score},\
+    setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},\
+    setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{matched_var_name}=%{matched_var}'"


changed the message to class lets add this into a new rule, maybe a new PR if required

spartantri · 2018-02-05T18:48:50Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    setvar:'tx.msg=%{rule.msg}',\
+    setvar:tx.rce_score=+%{tx.notice_anomaly_score},\
+    setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},\
+    setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{matched_var_name}=%{matched_var}'"


Added to 944230 and class list into java-classes.data

lifeforms · 2018-02-05T20:07:44Z

Confirming that 2 false negatives are now gone!

Only this one is left, I don't know why it is not detecting:

http://localhost/?redirect:$%7B%23matt%3d%20%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.setContentType('text/plain'),%23matt.getWriter().println%20('successsuccess'),%23matt.getWriter().flush(),%23matt.getWriter().close()%7D

lifeforms · 2018-02-05T20:46:19Z

rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

+    tag:'paranoia-level/1',\
+    ctl:forceRequestBodyVariable=On,\
+    rev:'1',\
+    ver:'OWASP_CRS/3.1.0'"


We leave this in for now and create a separate issue on how to handle this generally in setup/initialization file.

@lifeforms There are no false negative on my tests but some of the rules were on pass instead of block for testing, changed all back to block, please test again

http://localhost/?redirect:$%7B%23matt%3d%20%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.setContentType('text/plain'),%23matt.getWriter().println%20('successsuccess'),%23matt.getWriter().flush(),%23matt.getWriter().close()%7D

[Tue Feb 06 19:04:15.778459 2018] [:error] [pid 13977] [client 127.0.0.1] ModSecurity: Warning. Matched phrase "com.opensymphony.xwork2" at ARGS_NAMES:redirect:${#matt= #context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),#matt.setContentType('text/plain'),#matt.getWriter().println ('successsuccess'),#matt.getWriter().flush(),#matt.getWriter().close()}. [file "/home/spartan/owasp-modsecurity-crs/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] [line "160"] [id "944230"] [rev "1"] [msg "Suspicious Java class detected"] [data "Matched Data: redirect:${#matt= #context.get('com.opensymphony.xwork2.dispatcher.httpservletresponse'),#matt.setcontenttype('text/plain'),#matt.getwriter().println ('successsuccess'),#matt.getwriter().flush(),#matt.getwriter().close()} found within ARGS_NAMES:redirect:${#matt= #context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),#matt.setContentType('text/plain'),#matt.getWriter().println ('successsuccess'),#matt.getWriter().flush(),#matt.getWriter().close()}"] [severity "NOTICE"] [ver "OWASP_CRS/3.1.0"] [tag "application-multi"] [tag "l [hostname "localhost"] [uri "/"] [unique_id "WnnuH38AAQEAADaZIF4AAAAK"]

lifeforms · 2018-02-05T20:49:45Z

Decision: I will merge this after a final test run, Friday at the latest!

spartantri · 2018-02-06T12:25:04Z

@lifeforms Some rules including pmf were in pass, changed back to block, please test again

lifeforms · 2018-02-09T20:49:47Z

Thanks for the updates...

I now tried out the PR on a clean checkout, so I was using paranoia level 1, and I notice that there are no rules active in this level... Is that intended? Lol, due to this I've wasted a lot of time redoing my install... Hence my review is a bit shorter than I'd liked.

Rule 944230 has a NOTICE severity but a critical score. I think the severity should be changed to CRITICAL.
Personally, I think that most of the detections would be completely fine at paranoia level 1. It is what I did for most PHP rules having signatures which don't appear regularly in normal text — And the PHP rules rarely give users false positives problems now. I think it will be the same for the Java rules. It's a judgement call. But I would recommend to move all your PL2 rules to PL1 and make them active by default. You don't have to be shy, we have had much much worse rules in the default install ;)
I also still feel that rule 944300 could be in PL1 (Java serialized object magic bytes detection, now PL3). It's been a common vulnerability and if an application wants to use this (discouraged) practice, manual user whitelisting would be advised. It looks that we disagree on the PL though, so do other people have insights/opinions?
Some rules have severity NOTICE. This is pretty rare in the CRS, and I personally don't think that NOTICE rules are highly useful (I just want to block definitive exploits, and I want as little log noise as possible, also I want as little code as possible since maintenance all adds up). I would probably leave them out myself. But if you really love them and would feel they are useful in practice, then I definitely won't mind.

dune73 · 2018-02-09T21:09:18Z

I've stayed away from this discussion, but let me chime in on @lifeform's questions:

3: I do not think any special treatment with regards to PL is due. If FPs are nearly non-existent, then it should be PL1, if there are some, then it's a PL2, if they are frequent, then a PL3.

4: I'm generally all for CRITICAL in almost all cases.

spartantri · 2018-02-11T08:53:43Z

well then I lowered the PLs and changed the severity and scores to critical, it should be ready now

lifeforms · 2018-02-18T20:53:59Z

My tests are succeeding!

I did notice though that you put the deserialization magic bytes rule (944200) in PL2. Did you find false positives on this one? If so, PL2 is the best place for it, but it seems so rare that I think PL1 would be possible. That said, I have never run many Java applications (and especially no enterprise ones) so I'm surely not qualified.

Apart from this final point, I have only love to spread. It works really nicely whatever kind of exploit I know that I throw at it :)

spartantri · 2018-02-19T09:17:22Z

Hi @lifeforms, I let the 944200 at PL2 due that 4 bytes is not so long to avoid false positives. What can be done later is add an additional rule a bit more specific at PL1 to avoid false positive but yet grab serialized java objects.

lifeforms · 2018-03-05T19:57:01Z

MERGED 💃
Thanks so much for this awesome work!!!

spartantri and others added 4 commits November 27, 2017 11:19

Java attacks

8b6b24d

Java attacks sintax fix

846399d

Java attacks regex rx

c5f106c

Adjusted format to match cContributing.md plus 1 PL4 rule

212e7bf

spartantri self-assigned this Dec 31, 2017

spartantri added the Feature Request label Dec 31, 2017

Fixed false positive in PL4

036dcef

fzipi reviewed Jan 1, 2018

View reviewed changes

spartantri added 2 commits January 1, 2018 21:28

Unnecessary auditlog noise reduced

a360288

File upload checks

a21c199

spartantri mentioned this pull request Jan 2, 2018

January monthly meeting agenda #991

Closed

spartantri added 5 commits January 1, 2018 21:53

File upload checks

1053a83

Fixed indentation

1fb2b57

Fixed indentation

95df058

Fixed indentation

8eb5163

File upload rules

9d9a8d4

spartantri added 3 commits January 2, 2018 09:57

PR990

69b25c3

Changed 944100 to nolog

96b4fb3

Adjusted transforms for 944320 due to false negative

c65f065

spartantri mentioned this pull request Jan 8, 2018

Create REQUEST-944-APPLICATION-ATTACK-JAVA.conf #881

Closed

spartantri added 4 commits February 5, 2018 19:35

Fixed indentation and moved 944340 to 944220

4613df8

Fixed indentation and moved 944340 to 944220

456e30b

Moved 944340 to 944220

7d38495

Added pmf to 944230 and java-classes.data

7f44f87

spartantri commented Feb 5, 2018

View reviewed changes

spartantri added 2 commits February 5, 2018 19:55

942410 had unescaped quotes

0a1e326

944230 set to critical

440dd30

spartantri added 3 commits February 5, 2018 21:32

Removed tests

ff5e98c

undo 942410 test change

ac0f1e7

readded the tests

72011b6

lifeforms reviewed Feb 5, 2018

View reviewed changes

lifeforms self-assigned this Feb 5, 2018

spartantri mentioned this pull request Feb 6, 2018

Malicious Content-Type in Apache Struts2. #703

Closed

changed all rules to block

d93ce1b

spartantri added 2 commits February 11, 2018 07:52

Adjusted PLs and severities

2cdcf28

Adjusted PLs and severities

959c1c3

spartantri added 2 commits February 11, 2018 20:18

Adjusted tests and test script

59cc1a2

missing transform, 944120 sibbling 944240

e8cc868

spartantri mentioned this pull request Mar 1, 2018

March monthly meeting agenda #1026

Closed

12 tasks

lifeforms merged commit a1cba01 into SpiderLabs:v3.1/dev Mar 5, 2018

CRS-migration-bot mentioned this pull request May 13, 2020

REQUEST-944-APPLICATION-ATTACK-JAVA.conf coreruleset/coreruleset#990

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

REQUEST-944-APPLICATION-ATTACK-JAVA.conf #990

REQUEST-944-APPLICATION-ATTACK-JAVA.conf #990

spartantri commented Dec 28, 2017

emphazer commented Dec 29, 2017

fzipi commented Dec 29, 2017

spartantri commented Dec 31, 2017

emphazer commented Dec 31, 2017

fzipi Jan 1, 2018

spartantri Jan 2, 2018

fzipi Jan 1, 2018

fzipi Jan 1, 2018

fzipi Jan 1, 2018

spartantri Feb 5, 2018

fzipi Jan 1, 2018

spartantri Jan 2, 2018

spartantri commented Jan 2, 2018

spartantri left a comment

spartantri Feb 5, 2018

spartantri Feb 5, 2018

spartantri Feb 5, 2018

spartantri Feb 5, 2018

spartantri Feb 5, 2018

lifeforms commented Feb 5, 2018

lifeforms Feb 5, 2018

spartantri Feb 6, 2018

lifeforms commented Feb 5, 2018

spartantri commented Feb 6, 2018 •

edited

lifeforms commented Feb 9, 2018

dune73 commented Feb 9, 2018 •

edited

spartantri commented Feb 11, 2018

lifeforms commented Feb 18, 2018 •

edited

spartantri commented Feb 19, 2018

lifeforms commented Mar 5, 2018

REQUEST-944-APPLICATION-ATTACK-JAVA.conf #990

REQUEST-944-APPLICATION-ATTACK-JAVA.conf #990

Conversation

spartantri commented Dec 28, 2017

emphazer commented Dec 29, 2017

fzipi commented Dec 29, 2017

spartantri commented Dec 31, 2017

emphazer commented Dec 31, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spartantri commented Jan 2, 2018

spartantri left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lifeforms commented Feb 5, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lifeforms commented Feb 5, 2018

spartantri commented Feb 6, 2018 • edited

lifeforms commented Feb 9, 2018

dune73 commented Feb 9, 2018 • edited

spartantri commented Feb 11, 2018

lifeforms commented Feb 18, 2018 • edited

spartantri commented Feb 19, 2018

lifeforms commented Mar 5, 2018

spartantri commented Feb 6, 2018 •

edited

dune73 commented Feb 9, 2018 •

edited

lifeforms commented Feb 18, 2018 •

edited